which is also not acceptable for some \(k\) . Considering a simple example which embeds watermarks into the 10-class CIFAR-10 dataset [1]}, we choose \(\mu = \nu = 4\)  and assume that it takes \(0.01\)  second for one sample's inference. For a 1000-image trigger set, it would then take approximately 3170 years to traverse the secret key space.
